oriiion Logo

Data Incident Response Procedures

Last updated: 10/6/2025

1. Incident Response Overview

This document outlines oriiion's procedures for responding to data security incidents in compliance with GDPR, CCPA, ISO 27001, and SOC 2 requirements.

Immediate Response (First 2 Hours)

  • Contain the incident and prevent further data exposure
  • Assess the scope and severity of the breach
  • Document all incident details and response actions
  • Notify the incident response team and management

2. Incident Classification

High Severity

Large-scale data breach affecting personal data of users, payment information, or business-critical systems

Response Time: Immediate (within 1 hour)

Medium Severity

Limited data exposure, system compromise without confirmed data access, or significant service disruption

Response Time: Within 4 hours

Low Severity

Potential security incident, minor data exposure, or isolated system issues

Response Time: Within 24 hours

3. Incident Response Team Contacts

Internal Team

  • Data Protection Officer: Sibbe Silvén
  • Emergency Email: data@oriiion.ai
  • Emergency Phone: +46765486019

External Authorities

  • Swedish DPA: Integritetsskyddsmyndigheten (IMY)
  • EU Authorities: Relevant EU data protection authorities
  • Customer Notification: Via email and platform notifications

4. Regulatory Compliance Requirements

GDPR Compliance (EU Users)

  • Notify supervisory authority within 72 hours
  • Notify users if high risk to rights and freedoms
  • Provide clear information about the breach to affected users
  • Maintain detailed breach documentation and evidence

CCPA Compliance (California Users)

  • Notify California residents without unreasonable delay
  • Provide information about user rights and remedies
  • Cooperate with California Attorney General if required

5. Response Procedure Steps

  1. Immediate incident containment and system isolation
  2. Evidence preservation and forensic data collection
  3. Impact assessment and affected user identification
  4. Risk evaluation and severity classification
  5. Regulatory authority notification (if required)
  6. User communication and notification process
  7. Remediation implementation and system recovery
  8. Post-incident review and process improvement

6. Reporting a Security Incident

If you discover or suspect a security incident, please report it immediately using the contact information below:

Emergency Reporting

For immediate security incidents requiring urgent response:

Security Email: security@oriiion.ai

Emergency Phone: +46765486019